pub struct TransparencyInclusion {
pub leaf_hash: MerkleHash,
pub inclusion_proof: InclusionProof,
pub signed_checkpoint: SignedCheckpoint,
pub consistency_proof: Option<ConsistencyProof>,
}Expand description
The transparency-log evidence that proves an artifact’s entry is in the log, bundled so a row verifies offline.
inclusion_proof proves the leaf_hash is in the tree at size N (root
inclusion_proof.root). When the inclusion was taken at a tree size older
than the embedded signed_checkpoint, a consistency_proof (N→M) proves the
older root is a prefix of the checkpoint root. With no consistency proof the
inclusion must be against the checkpoint (same root and size).
Fields§
§leaf_hash: MerkleHashThe artifact’s transparency-log leaf hash (the value inclusion_proof
proves). For a release row the leaf data is the canonical artifact
digest string (sha256:<hex>), so leaf_hash = hash_leaf(artifact_digest) — row verification re-derives and compares
it, binding the proof to this artifact rather than to whatever leaf
the prover chose to embed.
inclusion_proof: InclusionProofInclusion proof for leaf_hash at tree size inclusion_proof.size.
signed_checkpoint: SignedCheckpointThe signed checkpoint the inclusion is anchored to (directly, or via the
consistency proof). Its signature is verified against the verifier’s
pinned log key when one is supplied to
verify_evidence_pack_offline — upgrading “in the log” from bare
Merkle membership to operator-attested non-repudiation.
consistency_proof: Option<ConsistencyProof>Consistency proof from the inclusion’s tree size to the checkpoint’s, present only when the inclusion was taken at an earlier size than the checkpoint.
Trait Implementations§
Source§impl Clone for TransparencyInclusion
impl Clone for TransparencyInclusion
Source§fn clone(&self) -> TransparencyInclusion
fn clone(&self) -> TransparencyInclusion
1.0.0 (const: unstable) · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more